0 Replies Latest reply on Mar 31, 2020 3:54 PM by evil242

    DFW Blocks dch-photon through VCH unless destination any:any specified

    evil242 Novice

      I'm trying to setup VMware Integrated Containers in NSX when I came across interesting issue.

       

      I set up the test network in the diagram included below.  But basically used an L2 non-routed VXLAN network for my bridge network and routed L3 VXLAN

       

      Following Build, Push, and Pull and Image · VMware vSphere Integrated Containers 1.4 Documentation

       

           docker -H <VCHost> run --name build-slave -d -p 12375:2375 <dev-vic-registry>/default-project/dch-photon:1.13-cert

       

      Creates a "container" VM with the private IP 172.16.0.2 which communicates with the VCH, 172.16.0.1, across the bridge network.

       

      I created special DFW rule for the 172.16.0.0/16 to communicate with the VCH (first on DNS, but then ANY).

       

      There is an outbound rule that allows for all VMs on the cluster to communicate outbound, but it appears that the dch-photon container is not allowed to communicate outbound to docker.io container registry with out a destination any:service any rule in place.  Any thoughts or suggestions about better rule to allow DCH to NAT the traffic from the dch-photon engine?

       

      VIC-VCH-build-slave-issue.png